ci(workflow-delivery): finalize destination acceptance retry 4

[hcoona]

Summary

• bind the retry-4 workflow dispatch default and fixed target to preparation merge 835b81be1ff0ba7aa0ec23c9a7b518d4ade3dfaa
• bind the closed retry-4 Governance profile to the same reviewed preparation merge, never to this finalization commit
• strengthen target-pinned contracts for finalized guard execution, rejected-dispatch terminal identity, complete real-registry admission, and cross-profile isolation
• record the authenticated preflight, protected Environment, and mandatory non-bypass/fresh-preflight gates across current Workflow Delivery v3 state documents

Protected state

Fresh authenticated preflight confirmed exact main@835b81be, active ruleset and retry-4 workflow identity, green checks, no nonterminal or retry-4 workflow runs, no deployments or acceptance refs, and absent .13 through .16 package versions and wdv3-acceptance-13 through -16 npm tags.

Environment workflow-delivery-v3-buddy-smoke-acceptance-retry-4 exists as ID 20772100445 with sole required reviewer hcoona (712433), prevent_self_review=false, and one custom deployment branch policy for main.

Safety boundary

This PR does not dispatch the workflow, create an acceptance ref, approve a deployment, or mutate any package or tag. Zero and wrong dispatch inputs still fail before Environment review or either packages: write probe. Normal Live and live_enabled: true remain unauthorized. No bypass is permitted.

After this PR merges without bypass, a fresh exact preflight must pass before any acceptance ref is created or the single authorized run_attempt == 1 dispatch occurs. Any nonterminal or ambiguous state stops the operation for reconciliation.

Validation

• tests-first RED: 21 failed, 362 passed, all from the three expected zero target bindings
• focused retry-4 workflow and Governance contracts: 383 passed
• focused Adapter, topology, workflow, retirement, and Governance suite: 806 passed
• complete Workflow Delivery v3 suite: 3,837 passed
• Ruff, Ruff format, Pyrefly, Actionlint, Prettier, and markdownlint
• unstaged and staged HK gates, each including 3,837 passed
• multi-reviewer OCR review with independent TP/FP adjudication and clean rereview

Coordination

#595 and #605 still modify .github/workflows/ci.yml but are not merged into this branch. #604 changes only .NET package versions and lock files. Their work is not duplicated here.

[Copilot]

🔵 Needs a closer look

It activates a one-shot package-writing workflow whose safety depends on protected external state and a fresh post-merge preflight.

Pull request overview

Finalizes retry-4 destination acceptance by pinning the workflow and Governance profile to PR #608’s preparation merge.

Changes:

• Pins the accepted target SHA and strengthens contracts.
• Records preflight, Environment, and post-merge safety gates.
• Preserves historical zero-target rejection behavior.

File summaries

File	Description
.github/workflows/workflow-delivery-v3-buddy-smoke-acceptance-retry-4.yml	Pins the dispatch and guard target.
governance.py	Finalizes the retry-4 Governance profile.
test_commit10_acceptance_retry_4_workflow.py	Tests finalized workflow behavior.
test_commit10_acceptance_evidence.py	Tests admission and profile isolation.
docs/wiki/overview.md	Updates the current acceptance state.
docs/wiki/log.md	Records finalization activity.
docs/wiki/analyses/workflow-delivery/v3/README.md	Updates required next steps.
docs/wiki/analyses/workflow-delivery/v3/hcoona-release-smoke-npm-lld.md	Documents finalization safety gates.
docs/wiki/analyses/workflow-delivery/v3/agent-handoff.md	Updates the authoritative handoff.
.testagent/status.md	Records validation and review results.
.testagent/research.md	Records target and preflight research.
.testagent/plan.md	Records the protected-finalization plan.

Review details

• Files reviewed: 12/12 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.